Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-01 18:50:34 +03:00
Code Issues Packages Projects Releases Wiki Activity

feat(mbedtls/esp_mac): Support Key Manager key using the ESP-HMAC PSA interface

Browse Source
This commit is contained in:
harshal.patil
2026-03-03 18:40:31 +05:30
parent 30a120c7cb
commit 8036017951
4 changed files with 42 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/esp_tee/subproject/components/tee_sec_storage/tee_sec_storage.c
+3 -1
View File
@@ -156,7 +156,9 @@ static esp_err_t compute_nvs_keys_with_hmac(esp_efuse_block_t key_blk, nvs_sec_c
// Create opaque key reference
esp_hmac_opaque_key_t opaque_key = {
.use_km_key = false,
#if SOC_KEY_MANAGER_SUPPORTED
.key_recovery_info = NULL,
#endif /* SOC_KEY_MANAGER_SUPPORTED */
.efuse_key_id = hmac_key_id,
};
components/mbedtls/port/esp_hmac_pbkdf2.c
+4 -1
View File
@@ -52,7 +52,10 @@ esp_err_t esp_hmac_derive_pbkdf2_key(hmac_key_id_t key_id, const uint8_t *salt,
// Create opaque key reference
esp_hmac_opaque_key_t opaque_key = {
.use_km_key = false,
// TODO: Support key recovery info for HMAC key in PBKDF2 after PSA migration of this API is done
#if SOC_KEY_MANAGER_SUPPORTED
.key_recovery_info = NULL,
#endif /* SOC_KEY_MANAGER_SUPPORTED */
.efuse_key_id = key_id,
};
components/mbedtls/port/psa_driver/esp_mac/psa_crypto_driver_esp_hmac_opaque.c
+27 -4
View File
@@ -13,9 +13,19 @@
#include "hal/hmac_types.h"
#include "esp_hmac.h"
#if SOC_KEY_MANAGER_SUPPORTED
#include "esp_key_mgr.h"
#endif /* SOC_KEY_MANAGER_SUPPORTED */
static bool validate_hmac_opaque_key_attributes(const esp_hmac_opaque_key_t *opaque_key)
{
// efuse_key_id is uint8_t, so it's always >= 0 (EFUSE_BLK0)
#if SOC_KEY_MANAGER_SUPPORTED
if (opaque_key->key_recovery_info) {
return true;
}
#endif /* SOC_KEY_MANAGER_SUPPORTED */
// efuse_key_id is uint8_t, so opaque_key->efuse_key_id + EFUSE_BLK_KEY0 >= EFUSE_BLK_KEY0
if (((opaque_key->efuse_key_id + EFUSE_BLK_KEY0) < EFUSE_BLK_KEY_MAX)
&& (esp_efuse_get_key_purpose(EFUSE_BLK_KEY0 + opaque_key->efuse_key_id) == ESP_EFUSE_KEY_PURPOSE_HMAC_UP)) {
return true;
@@ -106,13 +116,26 @@ psa_status_t esp_hmac_update_opaque(esp_hmac_opaque_operation_t *esp_hmac_ctx, c
hmac_key_id_t hmac_key_id = esp_hmac_ctx->opaque_key->efuse_key_id;
#if SOC_KEY_MANAGER_HMAC_KEY_DEPLOY
if (esp_hmac_ctx->opaque_key->use_km_key) {
#if SOC_KEY_MANAGER_SUPPORTED && !ESP_TEE_BUILD
esp_key_mgr_key_recovery_info_t *key_recovery_info = esp_hmac_ctx->opaque_key->key_recovery_info;
if (key_recovery_info) {
esp_err_t err = esp_key_mgr_activate_key(key_recovery_info);
if (err != ESP_OK) {
ESP_LOGE("ESP_HMAC_OPAQUE", "Failed to activate key: 0x%x", err);
return PSA_ERROR_INVALID_HANDLE;
}
hmac_key_id = HMAC_KEY_KM;
}
#endif /* SOC_KEY_MANAGER_HMAC_KEY_DEPLOY */
#endif /* SOC_KEY_MANAGER_SUPPORTED && !ESP_TEE_BUILD */
esp_err_t hmac_ret = esp_hmac_calculate(hmac_key_id, data, data_length, esp_hmac_ctx->hmac);
#if SOC_KEY_MANAGER_SUPPORTED && !ESP_TEE_BUILD
if (key_recovery_info) {
esp_key_mgr_deactivate_key(key_recovery_info->key_type);
}
#endif /* SOC_KEY_MANAGER_SUPPORTED && !ESP_TEE_BUILD */
if (hmac_ret == ESP_ERR_INVALID_ARG) {
return PSA_ERROR_INVALID_ARGUMENT;
} else if (hmac_ret == ESP_FAIL) {
components/mbedtls/port/psa_driver/include/psa_crypto_driver_esp_hmac_opaque_contexts.h
+8 -2
View File
@@ -11,6 +11,10 @@
#include "psa/crypto_driver_common.h"
#include "hal/hmac_types.h"
#if SOC_KEY_MANAGER_SUPPORTED
#include "esp_key_mgr.h"
#endif
#ifdef __cplusplus
extern "C" {
#endif
@@ -24,8 +28,10 @@ extern "C" {
* @brief Structure to store opaque HMAC key.
*/
typedef struct {
bool use_km_key; /**< Use key deployed in the key manager */
hmac_key_id_t efuse_key_id; /**< eFuse key block id for HMAC key */
uint8_t efuse_key_id; /**< eFuse key block id for HMAC key */
#if SOC_KEY_MANAGER_SUPPORTED
esp_key_mgr_key_recovery_info_t *key_recovery_info; /**< Pointer to the key recovery info for HMAC key */
#endif /* SOC_KEY_MANAGER_SUPPORTED */
} esp_hmac_opaque_key_t;
/**